If you get a false positive state change from the following monitor Server Service: Firewall Status Monitor
be sure to check the user under which the File Services Run AS Account is configured and then check the locale on the agent. The underlying script for the monitor CheckFirewallPort.vbs is English dependent and any other language locale will raise an incorrect state change.
If the run as account is blank, it will run with the default action account defined for the agent. If that is local system the corresponding registry key will be
[HKEY_USERS\.DEFAULT\Control Panel\International] "Locale"=
Locale 00000409 is for English